6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-6826

CVE-2026-6826: Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller

Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions.The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.9 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-6826

CVE-2026-6826:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
concrete5/concrete5	composer	< 9.5.1	9.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description clearly points to an unauthenticated file usage disclosure at the endpoint /ccm/system/dialogs/file/usage/{fID} due to a missing permission check in the 'usage controller'. The provided 9.5.1 release notes confirm this, explicitly mentioning the fix for CVE-2026-6826 and the related CVE-2026-8236 which references the same endpoint and mentions HackerOne report ID H1 3681128. By analyzing the commits between the vulnerable version (9.5.0) and the patched version (9.5.1), I identified commit e92cfcaac856bf87caca7fac27e4ba4608136c41 with the message "Fix 3681128 by removing unused dialogs, routes and views". This commit directly addresses the reported vulnerability. The changes in this commit include the complete removal of the concrete/controllers/dialog/file/usage.php file, which contained the Concrete\Controller\Dialog\File\Usage controller and its view method. The commit also removes the corresponding route from concrete/routes/dialogs/files.php. This indicates that the view function was the source of the vulnerability, and the fix was to remove this insecure functionality altogether.

Vulnerable functions

Concrete\Controller\Dialog\File\Usage::view

concrete/controllers/dialog/file/usage.php

The `view` method within the `Concrete\Controller\Dialog\File\Usage` controller was exposed at the endpoint `/ccm/system/dialogs/file/usage/{fID}` without any authentication or authorization checks. This allowed any unauthenticated user to query for arbitrary file IDs (`fID`) and receive a list of all pages where that file is used. This information disclosure included page IDs, handles, and full URLs, even for pages that were supposed to be restricted, leading to a significant information leak about the internal structure and content of the website.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.